マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話

お問い合わせ履歴

電話(英語)

+7 (495) 789-45-86

Profile

Trojan.MulDrop5.29689

Added to the Dr.Web virus database: 2014-06-01

Virus description added:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Om97832B55094' = '%HOMEPATH%\Ow24415Y94382\install.exe'
Malicious functions:
Creates and executes the following:
  • '%HOMEPATH%\Ow24415Y94382\install.exe'
Modifies file system :
Creates the following files:
  • %HOMEPATH%\Ow24415Y94382\39664.AOB
  • %HOMEPATH%\Ow24415Y94382\T90304D49096.YCK
  • %HOMEPATH%\Ow24415Y94382\E15799R83681.QCK
  • %HOMEPATH%\Ow24415Y94382\T60440S99559.LAQ
  • %HOMEPATH%\Ow24415Y94382\70470.IYV
  • %HOMEPATH%\Ow24415Y94382\99219.AKM
  • %HOMEPATH%\Ow24415Y94382\18932.WQL
  • %HOMEPATH%\Ow24415Y94382\22224.KGH
  • %HOMEPATH%\Ow24415Y94382\V60681G48913.ZZL
  • %HOMEPATH%\Ow24415Y94382\28434.VLW
  • %HOMEPATH%\Ow24415Y94382\J12497O67279.QQM
  • %HOMEPATH%\Ow24415Y94382\A40047S17259.BLC
  • %HOMEPATH%\Ow24415Y94382\O46215A1134.VSD
  • %HOMEPATH%\Ow24415Y94382\U96690D94327.FQG
  • %HOMEPATH%\Ow24415Y94382\97228.VHL
  • %HOMEPATH%\Ow24415Y94382\J52163A65928.QDA
  • %HOMEPATH%\Ow24415Y94382\H76854V19523.PYL
  • %HOMEPATH%\Ow24415Y94382\17611.ZWL
  • %HOMEPATH%\Ow24415Y94382\18915.DOS
  • %HOMEPATH%\Ow24415Y94382\50165.DHY
  • %HOMEPATH%\Ow24415Y94382\62568.DFJ
  • %HOMEPATH%\Ow24415Y94382\52952.CET
  • %HOMEPATH%\Ow24415Y94382\52451.IGU
  • %HOMEPATH%\Ow24415Y94382\F97421W47024.OXR
  • %HOMEPATH%\Ow24415Y94382\84559.IFP
  • %HOMEPATH%\Ow24415Y94382\U63444P99999.FQC
  • %HOMEPATH%\Ow24415Y94382\44422.HSJ
  • %HOMEPATH%\Ow24415Y94382\12393.JIF
  • %HOMEPATH%\Ow24415Y94382\81331.ZYX
  • %HOMEPATH%\Ow24415Y94382\33424.EMP
  • %HOMEPATH%\Ow24415Y94382\Y82438H14365.IFR
  • %HOMEPATH%\Ow24415Y94382\Z18925X83274.LMQ
  • %HOMEPATH%\Ow24415Y94382\P55529O93729.WRB
  • %HOMEPATH%\Ow24415Y94382\J52689O36124.LDA
  • %HOMEPATH%\Ow24415Y94382\77676.POU
  • %HOMEPATH%\Ow24415Y94382\Q44062X30698.NBV
  • %HOMEPATH%\Ow24415Y94382\89751.REC
  • %HOMEPATH%\Ow24415Y94382\98471.JGS
  • %HOMEPATH%\Ow24415Y94382\N20744Q22026.KBC
  • %HOMEPATH%\Ow24415Y94382\M55830K97324.UER
  • %HOMEPATH%\Ow24415Y94382\H40818L45180.KRC
  • %HOMEPATH%\Ow24415Y94382\78487.WET
  • %HOMEPATH%\Ow24415Y94382\17980.FRM
  • %HOMEPATH%\Ow24415Y94382\98729.WRQ
  • %HOMEPATH%\Ow24415Y94382\48253.OTA
  • %HOMEPATH%\Ow24415Y94382\F71936E87501.UNW
  • %HOMEPATH%\Ow24415Y94382\88163.USX
  • %HOMEPATH%\Ow24415Y94382\36214.HHY
  • %HOMEPATH%\Ow24415Y94382\O84601O60122.VUU
  • %HOMEPATH%\Ow24415Y94382\F62197G74221.MVU
  • %HOMEPATH%\Ow24415Y94382\49458.TAF
  • %HOMEPATH%\Ow24415Y94382\W41574H71397.OBM
  • %HOMEPATH%\Ow24415Y94382\7703.LKI
  • %HOMEPATH%\Ow24415Y94382\E99354V2396.YZK
  • %HOMEPATH%\Ow24415Y94382\Y99768J83998.HMU
  • %HOMEPATH%\Ow24415Y94382\14277.CMY
  • %HOMEPATH%\Ow24415Y94382\N15958O81811.SYI
  • %HOMEPATH%\Ow24415Y94382\Q62801U47785.IDR
  • %HOMEPATH%\Ow24415Y94382\B77528B6097.ECN
  • %HOMEPATH%\Ow24415Y94382\18856.YGQ
  • %HOMEPATH%\Ow24415Y94382\93082.FHV
  • %HOMEPATH%\Ow24415Y94382\85612.LHR
  • %HOMEPATH%\Ow24415Y94382\U30842P92125.ZDF
  • %HOMEPATH%\Ow24415Y94382\A30385E17629.BQW
  • %HOMEPATH%\Ow24415Y94382\M51382H70998.EWB
  • %HOMEPATH%\Ow24415Y94382\98304.GJH
  • %HOMEPATH%\Ow24415Y94382\I49775H92039.XEH
  • %HOMEPATH%\Ow24415Y94382\43563.YJU
  • %HOMEPATH%\Ow24415Y94382\B62996X83179.NDV
  • %HOMEPATH%\Ow24415Y94382\G6322J24186.DDO
  • %HOMEPATH%\Ow24415Y94382\94928.MTU
  • %HOMEPATH%\Ow24415Y94382\R37235D89776.XSG
  • %HOMEPATH%\Ow24415Y94382\W98925N9560.GMQ
  • %HOMEPATH%\Ow24415Y94382\D34120Z38620.CMT
  • %HOMEPATH%\Ow24415Y94382\19473.XAT
  • %HOMEPATH%\Ow24415Y94382\65807.XLK
  • %HOMEPATH%\Ow24415Y94382\G39220C74636.CFW
  • %HOMEPATH%\Ow24415Y94382\76598.CHJ
  • %HOMEPATH%\Ow24415Y94382\R83574J3200.TER
  • %HOMEPATH%\Ow24415Y94382\B15726F82129.OEV
  • %HOMEPATH%\Ow24415Y94382\46254.HEA
  • %HOMEPATH%\Ow24415Y94382\T42358I31337.CRQ
  • %HOMEPATH%\Ow24415Y94382\M83608Y6715.YST
  • %HOMEPATH%\Ow24415Y94382\B69471X22334.ANW
  • %HOMEPATH%\Ow24415Y94382\J89740U99831.PUJ
  • %HOMEPATH%\Ow24415Y94382\U33575T15501.TBK
  • %HOMEPATH%\Ow24415Y94382\78630.WOV
  • %HOMEPATH%\Ow24415Y94382\Y20156J84639.JSE
  • %HOMEPATH%\Ow24415Y94382\93546.BYP
  • %HOMEPATH%\Ow24415Y94382\23200.RLY
  • %HOMEPATH%\Ow24415Y94382\58833.LRD
  • %HOMEPATH%\Ow24415Y94382\6697.IRI
  • %HOMEPATH%\Ow24415Y94382\Z16051G41118.XKO
  • %HOMEPATH%\Ow24415Y94382\49665.QVF
  • %HOMEPATH%\Ow24415Y94382\E50389C41750.VTV
  • %HOMEPATH%\Ow24415Y94382\34722.ENX
  • %HOMEPATH%\Ow24415Y94382\A23413Z99457.CSY
  • %HOMEPATH%\Ow24415Y94382\84958.IJJ
  • %HOMEPATH%\Ow24415Y94382\O99659Y27394.GDN
  • %HOMEPATH%\Ow24415Y94382\26637.TCV
  • %HOMEPATH%\Ow24415Y94382\O17863Q65824.XUK
  • %HOMEPATH%\Ow24415Y94382\E62735F25849.VCK
  • %HOMEPATH%\Ow24415Y94382\G31454I77369.PPZ
  • %HOMEPATH%\Ow24415Y94382\T99269S53007.GUK
  • %HOMEPATH%\Ow24415Y94382\30610.UZV
  • %HOMEPATH%\Ow24415Y94382\Z74768B35478.ITU
  • %HOMEPATH%\Ow24415Y94382\71871.LTK
  • %HOMEPATH%\Ow24415Y94382\W99983B74490.IYS
  • %HOMEPATH%\Ow24415Y94382\Y77677L98649.DVA
  • %HOMEPATH%\Ow24415Y94382\6551.JXG
  • %HOMEPATH%\Ow24415Y94382\85986.CHG
  • %HOMEPATH%\Ow24415Y94382\92959.OUZ
  • %HOMEPATH%\Ow24415Y94382\M12901O5977.QOP
  • %HOMEPATH%\Ow24415Y94382\U30452I97644.OCD
  • %HOMEPATH%\Ow24415Y94382\59522.KWS
  • %HOMEPATH%\Ow24415Y94382\47063.YZQ
  • %HOMEPATH%\Ow24415Y94382\J31583J79012.QXN
  • %HOMEPATH%\Ow24415Y94382\K57376O89913.XYW
  • %HOMEPATH%\Ow24415Y94382\O15879A70847.MMQ
  • %HOMEPATH%\Ow24415Y94382\F56952D97102.GKA
  • %HOMEPATH%\Ow24415Y94382\61439.JYH
  • %HOMEPATH%\Ow24415Y94382\52343.OCR
  • %HOMEPATH%\Ow24415Y94382\30066.MNY
  • %HOMEPATH%\Ow24415Y94382\15523.KWK
  • %HOMEPATH%\Ow24415Y94382\S95444X91289.DPS
  • %HOMEPATH%\Ow24415Y94382\S5071J9077.KYJ
  • %HOMEPATH%\Ow24415Y94382\K55752B77286.GQC
  • %HOMEPATH%\Ow24415Y94382\83118.WOF
  • %HOMEPATH%\Ow24415Y94382\33306.XFP
  • %HOMEPATH%\Ow24415Y94382\J97000G10114.CVQ
  • %HOMEPATH%\Ow24415Y94382\84912.XEF
  • %HOMEPATH%\Ow24415Y94382\77067.DJQ
  • %HOMEPATH%\Ow24415Y94382\3272.VYC
  • %HOMEPATH%\Ow24415Y94382\46056.VAS
  • %HOMEPATH%\Ow24415Y94382\G94789T30024.JWM
  • %HOMEPATH%\Ow24415Y94382\R13014U77847.CQY
  • %HOMEPATH%\Ow24415Y94382\29640.TPV
  • %HOMEPATH%\Ow24415Y94382\40927.DYB
  • %HOMEPATH%\Ow24415Y94382\K97437R84247.GUG
  • %HOMEPATH%\Ow24415Y94382\Z69374Z41870.XQV
  • %HOMEPATH%\Ow24415Y94382\31725.IME
  • %HOMEPATH%\Ow24415Y94382\2707.OOO
  • %HOMEPATH%\Ow24415Y94382\90035.VMK
  • %HOMEPATH%\Ow24415Y94382\54800.JHT
  • %HOMEPATH%\Ow24415Y94382\27174.GCY
  • %HOMEPATH%\Ow24415Y94382\78320.LIY
  • %HOMEPATH%\Ow24415Y94382\T88671U96630.FPH
  • %HOMEPATH%\Ow24415Y94382\P34829N85904.APM
  • %HOMEPATH%\Ow24415Y94382\59731.ONA
  • %HOMEPATH%\Ow24415Y94382\64282.SZU
  • %HOMEPATH%\Ow24415Y94382\14405.XDL
  • %HOMEPATH%\Ow24415Y94382\1679.MSZ
  • %HOMEPATH%\Ow24415Y94382\68625.RMP
  • %HOMEPATH%\Ow24415Y94382\X14741C68354.TXM
  • %HOMEPATH%\Ow24415Y94382\A50654S11399.NJQ
  • %HOMEPATH%\Ow24415Y94382\36434.KLL
  • %HOMEPATH%\Ow24415Y94382\35020.KON
  • %HOMEPATH%\Ow24415Y94382\15456.DEJ
  • %HOMEPATH%\Ow24415Y94382\5687.YNK
  • %HOMEPATH%\Ow24415Y94382\R68003L37872.ZQE
  • %HOMEPATH%\Ow24415Y94382\80792.EUG
  • %HOMEPATH%\Ow24415Y94382\E81417U82194.LQG
  • %HOMEPATH%\Ow24415Y94382\94175.AYH
  • %HOMEPATH%\Ow24415Y94382\99759.JEK
  • %HOMEPATH%\Ow24415Y94382\J50043L96658.LFY
  • %HOMEPATH%\Ow24415Y94382\A40839M73797.SUA
  • %HOMEPATH%\Ow24415Y94382\V51795Q40726.ZXK
  • %HOMEPATH%\Ow24415Y94382\X44188Z56346.JGB
  • %HOMEPATH%\Ow24415Y94382\S16701E21776.TKZ
  • %HOMEPATH%\Ow24415Y94382\O45899G30812.NNJ
  • %HOMEPATH%\Ow24415Y94382\D54583P67752.PDY
  • %HOMEPATH%\Ow24415Y94382\21458.MLW
  • %HOMEPATH%\Ow24415Y94382\W51240J62849.HGO
  • %HOMEPATH%\Ow24415Y94382\N69927L6396.QTR
  • %HOMEPATH%\Ow24415Y94382\O53853C99353.ZID
  • %HOMEPATH%\Ow24415Y94382\70788.ZHR
  • %HOMEPATH%\Ow24415Y94382\D26756B63487.VRB
  • %HOMEPATH%\Ow24415Y94382\76173.VVP
  • %HOMEPATH%\Ow24415Y94382\73980.DNE
  • %HOMEPATH%\Ow24415Y94382\22478.KGM
  • %HOMEPATH%\Ow24415Y94382\17426.YRX
  • %HOMEPATH%\Ow24415Y94382\84665.LAX
  • %HOMEPATH%\Ow24415Y94382\48529.WXO
  • %HOMEPATH%\Ow24415Y94382\M91355T83951.MPT
  • %HOMEPATH%\Ow24415Y94382\41913.QJY
  • %HOMEPATH%\Ow24415Y94382\W58441R76878.LAP
  • %HOMEPATH%\Ow24415Y94382\10769.XKG
  • %HOMEPATH%\Ow24415Y94382\B97268H21566.DVE
  • %HOMEPATH%\Ow24415Y94382\MB.OTI
  • %HOMEPATH%\Ow24415Y94382\62163.TWK
  • %HOMEPATH%\Md89835O64664.HU3
  • %TEMP%\aut1.tmp
  • %HOMEPATH%\Ow24415Y94382\91136.IVS
  • %HOMEPATH%\Ow24415Y94382\P15600P30536.NMK
  • %HOMEPATH%\Ow24415Y94382\79073.API
  • %HOMEPATH%\Ow24415Y94382\E17016F78347.SAB
  • %HOMEPATH%\Ow24415Y94382\F54560L34343.RBH
  • %HOMEPATH%\Ow24415Y94382\76045.ZQH
  • %HOMEPATH%\Ow24415Y94382\F25809L87746.ASG
  • %HOMEPATH%\Ow24415Y94382\K97728H34527.LFI
  • %HOMEPATH%\Ow24415Y94382\16667.AFW
  • %HOMEPATH%\Ow24415Y94382\H49009J55635.KFK
  • %HOMEPATH%\Ow24415Y94382\P19710G90571.IBN
  • %HOMEPATH%\Ow24415Y94382\95224.UCV
  • %HOMEPATH%\Ow24415Y94382\Z95970O49373.CDA
  • %HOMEPATH%\Ow24415Y94382\T97920B47375.PAE
  • %HOMEPATH%\Ow24415Y94382\Q21791A18081.ACV
  • %HOMEPATH%\Ow24415Y94382\36394.RMN
  • %HOMEPATH%\Ow24415Y94382\H19818T16902.SPI
  • %HOMEPATH%\Ow24415Y94382\M47408Y56211.DDK
  • %HOMEPATH%\Ow24415Y94382\Y91250U93562.HKN
  • %HOMEPATH%\Ow24415Y94382\W46276P76180.EJX
  • %HOMEPATH%\Ow24415Y94382\S17990P33126.BCG
  • %HOMEPATH%\Ow24415Y94382\70376.QJW
  • %HOMEPATH%\Ow24415Y94382\V38948O68873.JXP
  • %HOMEPATH%\Ow24415Y94382\43887.OQK
  • %HOMEPATH%\Ow24415Y94382\80778.WGB
  • %HOMEPATH%\Ow24415Y94382\33918.SMM
  • %HOMEPATH%\Ow24415Y94382\48338.CBX
  • %HOMEPATH%\Ow24415Y94382\G24051U27421.HUQ
  • %HOMEPATH%\Ow24415Y94382\H55416S91576.WYZ
  • %HOMEPATH%\Ow24415Y94382\E43904Q10018.RVT
  • %HOMEPATH%\Ow24415Y94382\15538.DWA
  • %HOMEPATH%\Ow24415Y94382\32151.IRT
  • %HOMEPATH%\Ow24415Y94382\Z33429Y4790.RWA
  • %HOMEPATH%\Ow24415Y94382\H21025K41349.TIZ
  • %HOMEPATH%\Ow24415Y94382\G90256U23139.QUB
  • %HOMEPATH%\Ow24415Y94382\31125.HAL
  • %HOMEPATH%\Ow24415Y94382\L23219V77883.LNO
  • %HOMEPATH%\Ow24415Y94382\5379.ENG
  • %HOMEPATH%\Ow24415Y94382\33237.RZZ
  • %HOMEPATH%\Ow24415Y94382\F65979A14733.VDO
  • %HOMEPATH%\Ow24415Y94382\55104.CCC
  • %HOMEPATH%\Ow24415Y94382\B84056Q13900.RGC
  • %HOMEPATH%\Ow24415Y94382\52110.HVA
  • %HOMEPATH%\Ow24415Y94382\N63647H98014.SLB
  • %HOMEPATH%\Ow24415Y94382\27938.VMU
  • %HOMEPATH%\Ow24415Y94382\8833.FPY
  • %HOMEPATH%\Ow24415Y94382\N51898R31054.PJV
  • %HOMEPATH%\Ow24415Y94382\M18535J77976.TPI
  • %HOMEPATH%\Ow24415Y94382\1971.JMI
  • %HOMEPATH%\Ow24415Y94382\O3162H20873.DZI
  • %HOMEPATH%\Ow24415Y94382\23743.OSV
  • %HOMEPATH%\Ow24415Y94382\K61894F31901.AGN
  • %HOMEPATH%\Ow24415Y94382\92493.CGS
  • %HOMEPATH%\Ow24415Y94382\31213.HEL
  • %HOMEPATH%\Ow24415Y94382\U3569F83540.ZOQ
  • %HOMEPATH%\Ow24415Y94382\22393.QAQ
  • %HOMEPATH%\Ow24415Y94382\I98632L23653.HBQ
  • %HOMEPATH%\Ow24415Y94382\C5227M18849.CSU
  • %HOMEPATH%\Ow24415Y94382\G86368G47802.CCZ
  • %HOMEPATH%\Ow24415Y94382\79904.QTL
  • %HOMEPATH%\Ow24415Y94382\28611.NWJ
  • %HOMEPATH%\Ow24415Y94382\4221.RPF
  • %HOMEPATH%\Ow24415Y94382\I74361V64148.MGN
  • %HOMEPATH%\Ow24415Y94382\79801.GYC
  • %HOMEPATH%\Ow24415Y94382\Q37510K57768.HGC
  • %HOMEPATH%\Ow24415Y94382\V34844B82958.AXV
  • %HOMEPATH%\Ow24415Y94382\28649.BEI
  • %HOMEPATH%\Ow24415Y94382\80248.STV
  • %HOMEPATH%\Ow24415Y94382\65810.QQD
  • %HOMEPATH%\Ow24415Y94382\Q84656A82610.OJC
  • %HOMEPATH%\Ow24415Y94382\B99848W35108.RGX
  • %HOMEPATH%\Ow24415Y94382\73204.GSF
  • %HOMEPATH%\Ow24415Y94382\S35894L74403.VQW
  • %HOMEPATH%\Ow24415Y94382\L22574O39106.IUI
  • %HOMEPATH%\Ow24415Y94382\48240.ANR
  • %HOMEPATH%\Ow24415Y94382\P1084O42147.PXI
  • %HOMEPATH%\Ow24415Y94382\B77451B67494.HQI
  • %HOMEPATH%\Ow24415Y94382\B51312G65385.VNH
  • %HOMEPATH%\Ow24415Y94382\F69087J90766.ZBV
  • %HOMEPATH%\Ow24415Y94382\28315.YEH
  • %HOMEPATH%\Ow24415Y94382\J97383G69263.OYN
  • %HOMEPATH%\Ow24415Y94382\40086.FUG
  • %HOMEPATH%\Ow24415Y94382\S59756C92927.PKY
  • %HOMEPATH%\Ow24415Y94382\O71461F75009.XVB
  • %HOMEPATH%\Ow24415Y94382\98024.EHG
  • %HOMEPATH%\Ow24415Y94382\A26686U68897.YSE
  • %HOMEPATH%\Ow24415Y94382\52578.TCW
  • %HOMEPATH%\Ow24415Y94382\S42061Q57347.IPF
  • %HOMEPATH%\Ow24415Y94382\38732.HES
  • %HOMEPATH%\Ow24415Y94382\T68048N34914.ZZK
  • %HOMEPATH%\Ow24415Y94382\74522.LBE
  • %HOMEPATH%\Ow24415Y94382\43469.OAC
  • %HOMEPATH%\Ow24415Y94382\K4187U60863.MBP
  • %HOMEPATH%\Ow24415Y94382\22756.GKO
  • %HOMEPATH%\Ow24415Y94382\70925.RFY
  • %HOMEPATH%\Ow24415Y94382\W65850E93277.TKJ
  • %HOMEPATH%\Ow24415Y94382\R95691G53555.JTW
  • %HOMEPATH%\Ow24415Y94382\40403.ROG
  • %HOMEPATH%\Ow24415Y94382\83644.KIT
  • %HOMEPATH%\Ow24415Y94382\B86049P87065.IUG
  • %HOMEPATH%\Ow24415Y94382\15666.EWD
  • %HOMEPATH%\Ow24415Y94382\A53759H68744.QHO
  • %HOMEPATH%\Ow24415Y94382\A92497L72737.UIU
  • %HOMEPATH%\Ow24415Y94382\L3086J30314.MEC
  • %HOMEPATH%\Ow24415Y94382\M53569C35297.VTT
  • %HOMEPATH%\Ow24415Y94382\G70615M26694.WHD
  • %HOMEPATH%\Ow24415Y94382\X65891P25716.LUR
  • %HOMEPATH%\Ow24415Y94382\K38555P68800.RAB
  • %HOMEPATH%\Ow24415Y94382\82341.JUH
  • %HOMEPATH%\Ow24415Y94382\U85367O98754.TDW
  • %HOMEPATH%\Ow24415Y94382\58922.CXL
  • %HOMEPATH%\Ow24415Y94382\Z32436O68822.EFF
  • %HOMEPATH%\Ow24415Y94382\38920.VOF
  • %HOMEPATH%\Ow24415Y94382\33996.ZKT
  • %HOMEPATH%\Ow24415Y94382\75121.SFL
  • %HOMEPATH%\Ow24415Y94382\V32788E97689.CNL
  • %HOMEPATH%\Ow24415Y94382\99756.ZSL
  • %HOMEPATH%\Ow24415Y94382\88772.WPV
  • %HOMEPATH%\Ow24415Y94382\Z58377I10210.IIO
  • %HOMEPATH%\Ow24415Y94382\2578.ZBJ
  • %HOMEPATH%\Ow24415Y94382\56569.CVR
  • %HOMEPATH%\Ow24415Y94382\U98018E58440.EAK
  • %HOMEPATH%\Ow24415Y94382\15383.RMV
  • %HOMEPATH%\Ow24415Y94382\G32942E56521.FQD
  • %HOMEPATH%\Ow24415Y94382\E12540R59988.DTZ
  • %HOMEPATH%\Ow24415Y94382\B99140Z66720.BUG
  • %HOMEPATH%\Ow24415Y94382\69462.XFM
  • %HOMEPATH%\Ow24415Y94382\3766.RFQ
  • %HOMEPATH%\Ow24415Y94382\F62485P65156.QLP
  • %HOMEPATH%\Ow24415Y94382\U62357D60214.FDR
  • %HOMEPATH%\Ow24415Y94382\73402.UNR
  • %HOMEPATH%\Ow24415Y94382\I46744P57636.SLE
  • %HOMEPATH%\Ow24415Y94382\S62737X29419.FCO
  • %HOMEPATH%\Ow24415Y94382\3713.WGO
  • %HOMEPATH%\Ow24415Y94382\L67531E68611.PAY
  • %HOMEPATH%\Ow24415Y94382\63300.ZUC
  • %HOMEPATH%\Ow24415Y94382\76070.HYB
  • %HOMEPATH%\Ow24415Y94382\I26389V52632.BPH
  • %HOMEPATH%\Ow24415Y94382\34969.CDP
  • %HOMEPATH%\Ow24415Y94382\21881.LYJ
  • %HOMEPATH%\Ow24415Y94382\21318.JZC
  • %HOMEPATH%\Ow24415Y94382\M14338V59837.ZHI
  • %HOMEPATH%\Ow24415Y94382\J55553I94221.RNK
  • %HOMEPATH%\Ow24415Y94382\18465.BKG
  • %HOMEPATH%\Ow24415Y94382\89204.VAU
  • %HOMEPATH%\Ow24415Y94382\F62021L32841.TVQ
  • %HOMEPATH%\Ow24415Y94382\85909.QWJ
  • %HOMEPATH%\Ow24415Y94382\63701.MKX
  • %HOMEPATH%\Ow24415Y94382\29701.VGA
  • %HOMEPATH%\Ow24415Y94382\H33700D72034.TBZ
  • %HOMEPATH%\Ow24415Y94382\11376.WGI
  • %HOMEPATH%\Ow24415Y94382\F81901L95241.FSV
  • %HOMEPATH%\Ow24415Y94382\98652.ACV
  • %HOMEPATH%\Ow24415Y94382\45321.RNK
  • %HOMEPATH%\Ow24415Y94382\89975.ONU
  • %HOMEPATH%\Ow24415Y94382\O88471R56432.PRQ
  • %HOMEPATH%\Ow24415Y94382\Y88818T79362.FPL
  • %HOMEPATH%\Ow24415Y94382\T45770D61927.POP
  • %HOMEPATH%\Ow24415Y94382\U95791M82933.LAN
  • %HOMEPATH%\Ow24415Y94382\65221.MGW
  • %HOMEPATH%\Ow24415Y94382\61494.DXD
  • %HOMEPATH%\Ow24415Y94382\V47281W93013.HWI
  • %HOMEPATH%\Ow24415Y94382\B18858F11068.HIS
  • %HOMEPATH%\Ow24415Y94382\18028.WQN
  • %HOMEPATH%\Ow24415Y94382\94922.PPH
  • %HOMEPATH%\Ow24415Y94382\E93831L13344.SXL
  • %HOMEPATH%\Ow24415Y94382\87120.SYZ
  • %HOMEPATH%\Ow24415Y94382\57522.YRJ
  • %HOMEPATH%\Ow24415Y94382\54392.FAK
  • %HOMEPATH%\Ow24415Y94382\29566.DMJ
  • %HOMEPATH%\Ow24415Y94382\Z21450V14165.SAM
  • %HOMEPATH%\Ow24415Y94382\O66803J38129.CWJ
  • %HOMEPATH%\Ow24415Y94382\C96960I33655.QNZ
  • %HOMEPATH%\Ow24415Y94382\Z69143N72144.GYG
  • %HOMEPATH%\Ow24415Y94382\V33395M92765.INX
  • %HOMEPATH%\Ow24415Y94382\O98001Q14766.KNV
  • %HOMEPATH%\Ow24415Y94382\N49642Q72685.DQN
  • %HOMEPATH%\Ow24415Y94382\44658.SKW
  • %HOMEPATH%\Ow24415Y94382\86105.XHD
  • %HOMEPATH%\Ow24415Y94382\C27107Y91967.LUY
  • %HOMEPATH%\Ow24415Y94382\41579.MGB
  • %HOMEPATH%\Ow24415Y94382\46483.GXB
  • %HOMEPATH%\Ow24415Y94382\D40170P82071.VWY
  • %HOMEPATH%\Ow24415Y94382\89466.DNE
  • %HOMEPATH%\Ow24415Y94382\45034.DPN
  • %HOMEPATH%\Ow24415Y94382\25916.XGI
  • %HOMEPATH%\Ow24415Y94382\74543.FND
  • %HOMEPATH%\Ow24415Y94382\L4618D89391.YUV
  • %HOMEPATH%\Ow24415Y94382\install.exe
  • %HOMEPATH%\Ow24415Y94382\14701.FNE
  • %HOMEPATH%\Ow24415Y94382\77254.IIO
  • %HOMEPATH%\Ow24415Y94382\21181.AYY
  • %HOMEPATH%\Ow24415Y94382\18405.UYP
  • %HOMEPATH%\Ow24415Y94382\I22831Z77317.KKT
  • %HOMEPATH%\Ow24415Y94382\30378.EBG
  • %HOMEPATH%\Ow24415Y94382\30602.VQV
  • %HOMEPATH%\Ow24415Y94382\I19442A31482.CQA
  • %HOMEPATH%\Ow24415Y94382\47007.YAC
  • %HOMEPATH%\Ow24415Y94382\10529.SUG
  • %HOMEPATH%\Ow24415Y94382\B69505B78488.RHI
  • %HOMEPATH%\Ow24415Y94382\M82226O9947.OJE
  • %HOMEPATH%\Ow24415Y94382\M40515C16934.NLA
  • %HOMEPATH%\Ow24415Y94382\I68790N55861.BME
  • %HOMEPATH%\Ow24415Y94382\V75352L93652.IRK
  • %HOMEPATH%\Ow24415Y94382\S49692C39925.VAO
  • %HOMEPATH%\Ow24415Y94382\78993.CJU
  • %HOMEPATH%\Ow24415Y94382\R76210H66459.HEM
  • %HOMEPATH%\Ow24415Y94382\M74400X41785.AFC
  • %HOMEPATH%\Ow24415Y94382\N25155E63302.QUW
  • %HOMEPATH%\Ow24415Y94382\N83817D23354.MID
  • %HOMEPATH%\Ow24415Y94382\18159.HPY
  • %HOMEPATH%\Ow24415Y94382\S55257B74607.IEY
  • %HOMEPATH%\Ow24415Y94382\87547.IWO
  • %HOMEPATH%\Ow24415Y94382\R65998I34123.TYN
  • %HOMEPATH%\Ow24415Y94382\O7914Z53053.RFK
  • %HOMEPATH%\Ow24415Y94382\A56038C88477.WYE
  • %HOMEPATH%\Ow24415Y94382\D30459B11676.XOL
  • %HOMEPATH%\Ow24415Y94382\F16672K7327.VSW
  • %HOMEPATH%\Ow24415Y94382\28083.ORH
  • %HOMEPATH%\Ow24415Y94382\10980.EGV
  • %HOMEPATH%\Ow24415Y94382\V30293R50372.RTT
  • %HOMEPATH%\Ow24415Y94382\70379.OWS
  • %HOMEPATH%\Ow24415Y94382\Z32693P60315.NUZ
  • %HOMEPATH%\Ow24415Y94382\H76745L81210.GMN
  • %HOMEPATH%\Ow24415Y94382\O8821Q16584.FUW
  • %HOMEPATH%\Ow24415Y94382\X69146K77296.JZK
  • %HOMEPATH%\Ow24415Y94382\66232.SGE
  • %HOMEPATH%\Ow24415Y94382\55899.AMK
  • %HOMEPATH%\Ow24415Y94382\62373.FSN
  • %HOMEPATH%\Ow24415Y94382\O20334U56002.IKG
  • %HOMEPATH%\Ow24415Y94382\60063.NEE
  • %HOMEPATH%\Ow24415Y94382\58140.FPB
  • %HOMEPATH%\Ow24415Y94382\14194.NFN
  • %HOMEPATH%\Ow24415Y94382\L22685C80710.PZO
  • %HOMEPATH%\Ow24415Y94382\D13830X4338.VHZ
  • %HOMEPATH%\Ow24415Y94382\L67046I86121.QNR
  • %HOMEPATH%\Ow24415Y94382\75806.CVZ
  • %HOMEPATH%\Ow24415Y94382\B80271X3901.WIO
  • %HOMEPATH%\Ow24415Y94382\W87911S55598.UBC
  • %HOMEPATH%\Ow24415Y94382\44761.UBH
  • %HOMEPATH%\Ow24415Y94382\55156.LBA
  • %HOMEPATH%\Ow24415Y94382\29530.ZWB
  • %HOMEPATH%\Ow24415Y94382\J28860Q74260.HLV
  • %HOMEPATH%\Ow24415Y94382\17309.JKD
  • %HOMEPATH%\Ow24415Y94382\96837.DHJ
  • %HOMEPATH%\Ow24415Y94382\37417.VPO
  • %HOMEPATH%\Ow24415Y94382\37183.TPW
  • %HOMEPATH%\Ow24415Y94382\T20523R90336.DYV
  • %HOMEPATH%\Ow24415Y94382\N22644N28915.MJH
  • %HOMEPATH%\Ow24415Y94382\S69678P29621.PPD
  • %HOMEPATH%\Ow24415Y94382\U77863Z78777.SHC
  • %HOMEPATH%\Ow24415Y94382\62064.NVU
  • %HOMEPATH%\Ow24415Y94382\M2902B39755.AQL
  • %HOMEPATH%\Ow24415Y94382\95602.OJS
  • %HOMEPATH%\Ow24415Y94382\I87797T81343.VRD
  • %HOMEPATH%\Ow24415Y94382\G4545U84700.TKM
  • %HOMEPATH%\Ow24415Y94382\93316.QCQ
  • %HOMEPATH%\Ow24415Y94382\38466.YMN
  • %HOMEPATH%\Ow24415Y94382\W82025D15232.VCT
  • %HOMEPATH%\Ow24415Y94382\28794.AXY
  • %HOMEPATH%\Ow24415Y94382\E25400S13309.QQH
  • %HOMEPATH%\Ow24415Y94382\1360.HAD
  • %HOMEPATH%\Ow24415Y94382\47027.OKD
  • %HOMEPATH%\Ow24415Y94382\T40787P87687.MCS
  • %HOMEPATH%\Ow24415Y94382\O15339G7012.VAU
  • %HOMEPATH%\Ow24415Y94382\12991.YFQ
  • %HOMEPATH%\Ow24415Y94382\P44391D40929.HOO
  • %HOMEPATH%\Ow24415Y94382\B48712V91577.IPK
  • %HOMEPATH%\Ow24415Y94382\L58005H76215.DMS
  • %HOMEPATH%\Ow24415Y94382\41504.IZY
  • %HOMEPATH%\Ow24415Y94382\45793.RGI
  • %HOMEPATH%\Ow24415Y94382\28731.WLZ
  • %HOMEPATH%\Ow24415Y94382\V99755F42431.VIO
  • %HOMEPATH%\Ow24415Y94382\L39866Y90188.CWB
  • %HOMEPATH%\Ow24415Y94382\F57989H49902.SKA
  • %HOMEPATH%\Ow24415Y94382\7689.YTF
  • %HOMEPATH%\Ow24415Y94382\Y68617C37558.LVY
  • %HOMEPATH%\Ow24415Y94382\53927.GXC
  • %HOMEPATH%\Ow24415Y94382\T45395N88208.YUU
  • %HOMEPATH%\Ow24415Y94382\70721.XEI
  • %HOMEPATH%\Ow24415Y94382\37249.TKK
  • %HOMEPATH%\Ow24415Y94382\34983.YUS
  • %HOMEPATH%\Ow24415Y94382\L63020R84633.YIU
  • %HOMEPATH%\Ow24415Y94382\H1953F71214.EYK
  • %HOMEPATH%\Ow24415Y94382\J37568W70243.UTO
  • %HOMEPATH%\Ow24415Y94382\46525.HKR
  • %HOMEPATH%\Ow24415Y94382\60769.BJM
  • %HOMEPATH%\Ow24415Y94382\B40304R78285.EZN
  • %HOMEPATH%\Ow24415Y94382\82273.NGF
  • %HOMEPATH%\Ow24415Y94382\99502.JGG
  • %HOMEPATH%\Ow24415Y94382\I55499Y89525.JPX
  • %HOMEPATH%\Ow24415Y94382\L43610L60657.QUX
  • %HOMEPATH%\Ow24415Y94382\U97072Y31944.XMT
  • %HOMEPATH%\Ow24415Y94382\91879.DEL
  • %HOMEPATH%\Ow24415Y94382\M85726C13960.IIQ
  • %HOMEPATH%\Ow24415Y94382\O87377J79730.QTX
  • %HOMEPATH%\Ow24415Y94382\M85040G18988.BOM
  • %HOMEPATH%\Ow24415Y94382\O50999N50789.YWB
  • %HOMEPATH%\Ow24415Y94382\A46932L58543.MOB
  • %HOMEPATH%\Ow24415Y94382\I62159S6954.QKI
  • %HOMEPATH%\Ow24415Y94382\3750.MCH
  • %HOMEPATH%\Ow24415Y94382\76654.ZIJ
  • %HOMEPATH%\Ow24415Y94382\21168.ONB
  • %HOMEPATH%\Ow24415Y94382\R32499E84253.NFU
  • %HOMEPATH%\Ow24415Y94382\48841.GOP
  • %HOMEPATH%\Ow24415Y94382\T50818D41033.UWE
  • %HOMEPATH%\Ow24415Y94382\36356.RWS
  • %HOMEPATH%\Ow24415Y94382\98541.IGS
  • %HOMEPATH%\Ow24415Y94382\G66745U22388.ZVM
  • %HOMEPATH%\Ow24415Y94382\D94779K28087.DOR
  • %HOMEPATH%\Ow24415Y94382\C4079M54848.GQK
  • %HOMEPATH%\Ow24415Y94382\N18252X18403.JRS
  • %HOMEPATH%\Ow24415Y94382\91991.IXW
  • %HOMEPATH%\Ow24415Y94382\58327.QPU
  • %HOMEPATH%\Ow24415Y94382\75509.ESJ
  • %HOMEPATH%\Ow24415Y94382\56209.OYO
  • %HOMEPATH%\Ow24415Y94382\R99118B64076.SHL
  • %HOMEPATH%\Ow24415Y94382\28777.NLF
  • %HOMEPATH%\Ow24415Y94382\S58946M65596.KPW
  • %HOMEPATH%\Ow24415Y94382\61269.XVW
  • %HOMEPATH%\Ow24415Y94382\90601.VMY
  • %HOMEPATH%\Ow24415Y94382\B81185S1355.THI
  • %HOMEPATH%\Ow24415Y94382\77624.LVM
  • %HOMEPATH%\Ow24415Y94382\14748.WWH
  • %HOMEPATH%\Ow24415Y94382\48646.IBZ
  • %HOMEPATH%\Ow24415Y94382\I16739G74895.QZK
  • %HOMEPATH%\Ow24415Y94382\66790.SEM
  • %HOMEPATH%\Ow24415Y94382\80245.CSU
  • %HOMEPATH%\Ow24415Y94382\58412.HVA
  • %HOMEPATH%\Ow24415Y94382\W75322G28716.INK
  • %HOMEPATH%\Ow24415Y94382\72126.DQL
  • %HOMEPATH%\Ow24415Y94382\C59062U97864.MOB
  • %HOMEPATH%\Ow24415Y94382\47124.BDJ
  • %HOMEPATH%\Ow24415Y94382\Z10359M74394.GSZ
  • %HOMEPATH%\Ow24415Y94382\X2031O91247.WID
  • %HOMEPATH%\Ow24415Y94382\84142.CER
  • %HOMEPATH%\Ow24415Y94382\2548.AXU
  • %HOMEPATH%\Ow24415Y94382\E40430R87670.BLL
  • %HOMEPATH%\Ow24415Y94382\W79875R8961.ESY
  • %HOMEPATH%\Ow24415Y94382\Z87842N77941.ZFJ
  • %HOMEPATH%\Ow24415Y94382\U51758V18040.RKD
  • %HOMEPATH%\Ow24415Y94382\R27381R98995.LTV
  • %HOMEPATH%\Ow24415Y94382\Y91696V99894.MHD
  • %HOMEPATH%\Ow24415Y94382\75998.KJN
  • %HOMEPATH%\Ow24415Y94382\U52937Z49472.VPD
  • %HOMEPATH%\Ow24415Y94382\X72016D10204.MKO
  • %HOMEPATH%\Ow24415Y94382\84843.HHD
  • %HOMEPATH%\Ow24415Y94382\32653.TYS
  • %HOMEPATH%\Ow24415Y94382\U63153L65641.TED
  • %HOMEPATH%\Ow24415Y94382\A82592T72431.AMX
  • %HOMEPATH%\Ow24415Y94382\H14463U39310.MCB
  • %HOMEPATH%\Ow24415Y94382\F82644L46796.RWL
  • %HOMEPATH%\Ow24415Y94382\K83502D28848.OWW
  • %HOMEPATH%\Ow24415Y94382\X33660Y84696.DRA
  • %HOMEPATH%\Ow24415Y94382\D24607O38620.LWW
  • %HOMEPATH%\Ow24415Y94382\E17248L90310.JFU
  • %HOMEPATH%\Ow24415Y94382\11081.WSH
  • %HOMEPATH%\Ow24415Y94382\86590.RAD
  • %HOMEPATH%\Ow24415Y94382\V41476H95328.QKO
  • %HOMEPATH%\Ow24415Y94382\S8269M13553.ZGW
  • %HOMEPATH%\Ow24415Y94382\99909.CPX
  • %HOMEPATH%\Ow24415Y94382\95448.CHC
  • %HOMEPATH%\Ow24415Y94382\93308.AMS
  • %HOMEPATH%\Ow24415Y94382\26415.XBE
  • %HOMEPATH%\Ow24415Y94382\74919.TQO
  • %HOMEPATH%\Ow24415Y94382\W10556A46826.OUR
  • %HOMEPATH%\Ow24415Y94382\A73280P77289.DUR
  • %HOMEPATH%\Ow24415Y94382\61741.EOG
  • %HOMEPATH%\Ow24415Y94382\W15051R32579.SVB
  • %HOMEPATH%\Ow24415Y94382\K13891Z50482.DHB
  • %HOMEPATH%\Ow24415Y94382\39047.VRF
  • %HOMEPATH%\Ow24415Y94382\6306.DWR
  • %HOMEPATH%\Ow24415Y94382\K60326H13511.SNX
  • %HOMEPATH%\Ow24415Y94382\E15761F54917.URJ
  • %HOMEPATH%\Ow24415Y94382\53623.XZY
  • %HOMEPATH%\Ow24415Y94382\44120.PND
  • %HOMEPATH%\Ow24415Y94382\K85400W49330.KBV
  • %HOMEPATH%\Ow24415Y94382\12074.SDI
  • %HOMEPATH%\Ow24415Y94382\Y64730Y20667.JCH
Sets the 'hidden' attribute to the following files:
  • %HOMEPATH%\Md89835O64664.HU3
Deletes the following files:
  • %TEMP%\aut1.tmp
Miscellaneous:
Searches for the following windows:
  • ClassName: 'Shell_TrayWnd' WindowName: '(null)'
  • ClassName: 'EDIT' WindowName: '(null)'

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android